OpenAI made the model request, not run, a function call

The conversation

On 13 June 2023, OpenAI published a post titled "Function calling and other API updates", introducing a way for an application to ask a chat model to call one of a set of described functions. Before this release, a model given a request had to reply in free text that a developer then had to parse to work out what the user wanted done. OpenAI frames function calling as letting developers "describe functions" and "have the model intelligently choose to output a JSON object containing arguments to call those functions," illustrated by turning "What's the weather like in Boston?" into a call such as get_current_weather(location, unit).

What the documents show

The announcement states the mechanism runs through two new Chat Completions parameters, functions and function_call, that "allow developers to describe functions to the model via JSON Schema." Retrieved 16 September 2026, OpenAI's current function-calling documentation describes the same idea today: a function or tool is "a piece of functionality that we tell the model it has access to," described by a JSON schema, and a function call is "a special kind of response we can get from the model" when it decides a tool is needed to follow the prompt. Both documents draw the same line on risk: the 2023 post warns that "a proof-of-concept exploit illustrates how untrusted data from a tool's output can instruct the model to perform unintended actions," and recommends "user confirmation steps before performing actions with real-world impact."

The system boundary

OpenAI's documentation is explicit the model itself never runs a function. The guide states: "When the model calls a function, you must execute it and return the result." The model's output is a request, a name and arguments matching the declared schema, and the application decides whether to run it and what to send back. Only after that result returns does the model produce an ordinary text response. This separation lets a developer add checks, permission gates, confirmation prompts, between a request and any real-world effect, since OpenAI's own architecture puts that step outside the model.

Where it fails

A model can request a function call with the wrong arguments, call a function that was not right for the task, or, per OpenAI's own 2023 warning, be steered into calling one by text embedded in an untrusted tool result; none of that is prevented by the JSON-schema mechanism, which only constrains the shape of the request, not its correctness. The safeguard the 2023 post recommends, confirmation before a consequential action, has to be built by the developer, since the API update itself imposes no such requirement.

• Is every function reachable by the model one whose real-world effect a user or a rule would want checked first?
• Where does user confirmation happen before a function with a real-world effect runs?
• Could text returned by a called function itself instruct the model to call something else?

Three years apart, OpenAI's announcement and its current guide describe the same division of labor: the model asks, in a structured shape it does not fully control, and the application decides whether to act.